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| ABSTRACT | 


A data governance policy is a foundational document providing instructions to manage data assets and 
organizational information effectively. Within the field of data governance, data access is one of the most 
important aspects of data management and includes considerations such as the extent of access, how to access 
data, access position, and data control and application. This research focuses on the banking industry, as its 
multiple stakeholders, diverse attitudes, and intangible aspects have created a problematic situation. To better 
understand and improve the current situation, soft systems methodology (SSM) provides a rich picture of the 
complex situation of data access in the bank, extracts key system definitions, and leads to a correct understanding 
of purposeful activities. After identifying these purposeful activities, a support policy for each set of activities is 
evaluated based on the literature in the field of data governance, specifically regarding data access. A mapping is 
established between activities and the fundamental principles of the data governance policy. One important 
innovation of this research is that, instead of directly utilizing SSM in the policy development process, it describes 
the situation and fundamental actions to provide the foundation for the policy. In conclusion, the data access 
problem has been identified as having various dimensions that can be grouped into six categories: data application, 
risk, processing, infrastructure, route, and access. These categories have been used to develop 13 support policy 
tules. 
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1. Introduction 


Over the last two decades, the word ‘governance’ has expanded and conquered new grounds 
and is now widely used (Micheli et al., 2020). In different realms of governance, data 
governance plays a prominent role in various organizations and is increasingly growing because 
the current trends keep up the pace. Data governance refers to the ownership of and controls 
over data management. Its objective is to increase the value of data assets in organizations and 
reduce relevant costs and risks (Abraham et al., 2019). Those data that are properly managed 
can be evolutionary and support sound decisions and measures (Reichental, 2023). 

A proper governance program includes a governance committee or assembly that complies 
with a set of procedures and programs for implementing them, given that the cornerstone of 
organizational data governance is the policy of managing and governing data (Khairi, 2019). A 
data governance policy is a base document comprising instructions and compliance to ensure 
effective data asset and organisation information management (Eryurek et al., 2021). This 
policy has been deemed a reference source for regulatory expectations that provide guidelines 
on organizational measures in the data domain. In this respect, a comprehensive policy on data 
governance must support key aspects, including systems or procedures associated with raw data 
security and control, internal auditing by quality control staff, report and investigation of 
suspicious violation cases of data integration, discipline measures, staff training when 
outsourcing or interacting with outside corporations (Truong et al., 2017). 

Data governance rules in policy documents comprised data access, usage, integration, 
integrity, provenance, retention, and archival policy (Eryurek et al., 2021; Reichental, 2023). 
Among these elements, data access, one of the most important aspects of data management, 
should be subject to governance rules. Data access, in brief, emphasizes who has access to what 
sort of data or what commitments must be provided to permit data access (Kerber, 2020). In 
other words, this aspect of governance incorporates the extent of access, how to access data, 
access position, and data control and application (Khatri and Brown, 2010). 

In this respect, some mechanisms are required to ensure principled data sharing and provide 
the possibility for data sharing and blocking of data sharing if necessary (Janssen et al., 2020). 
To this end, specific frameworks for trustworthy data sharing should be established, and the 
corresponding rules in governance policy can be investigated. Successful solutions to the 
problem of data access require an inclusive set of complementary enablers. In this context, the 


capability to cooperate, standardization, and security are among the mentioned enablers, which 
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is the proper analysis and design of a comprehensive data governance system (Kerber, 2020). 
Regarding cooperability, data access is a subcategory of the mentioned system because 
governance is achieved by complying with a set of laws and rules and implementing them and 
developed through collaborations and cooperation among players and stakeholders. Moreover, 
through proper adherence to the security aspects of data access in the data governance system 
as well as efficient management of data, one can reduce possible dangers to a minimum and 
meet the requirements (Reichental, 2023). 

The banking industry is one field that holds the issue of data access in high regard. Backed 
by the massive data centers of customers and the services they receive daily, the banking 
industry can produce big data. This issue has become more significant following the dominant 
spread of mobile phones in daily lives and other emerging technologies because most 
transactions and events in different cycles of banking services lead to big data (Bedeley, 2014). 
Even though the banking industry stands to benefit significantly from such a massive amount 
of data, it causes a series of challenges in the technology and governance layers since data 
access, especially banking data, is subject to the policy enforced, given that banks deal with 
vital data that require the highest level of privacy and security (Alhassan et al., 2019). 

By considering the commercial banks and investigating the data access issue in such 
organizations, this paper points out a significant problematic situation regarding cooperability 
between players and stakeholders and data access security (Kerber, 2020). Upon studying the 
aspects and characteristics of the problem under scrutiny, it can be stated that the mentioned 
problematic situation is quite complex and unstructured in this research. Such issues are 
strategic and enjoy essential features. These features include multi-stakeholders, perspectives, 
multi-dimensions, conflict of or incomparable interests, and other intangible aspects, along with 
uncertainty (Mingers and Rosenhead, 2004; Mingers, 2011). 

Table 1 shows that the current situation of common commercial banks is best characterized 
by complexity and non-structuring. In this table, among the set of problematic features, a 
description of data access problems in the banking industry is proportional to every feature in 
various situations. A profound understanding or analysis of the current situation has provided 


the insight given in the table, and it is required to analyse its various dimensions. 
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Table 1. Analysis of the problem in unstructured and ill-structured terms 
The complexity of the 


structure of the problem Description of the problem status in the case of the intended feature 


The process of applying for data at the bank level requires the presence of players and 
stakeholders. Applicants generally constitute bank-led marketing units, bank holding 
companies, and partner companies in active ecosystems. Further to the above, servicing 
Multi-stakeholders a wide spectrum of data applicants can be made possible by the unit management with 
the help of infrastructure provided by the IT management. This is while the acts enacted 
by the risk committee, along with their missions and instructions approved at the office 
of organizations & methods, lay the ground for such servicing. 
Data applicants often try to acquire the data and information they need while the owner 
or custodian of these data acts conservatively in presenting them. The problematic 
Multi-perspectives nature of the current situation is illustrated based on the convenience and extension 
aspects of data access about the risk of presenting data and in relation to the technical 
and operational aspects of data communication. 
Compatibility of a data application with current banking objectives and adaptability to 
the present rules and instructions are forms of uncertainty in the process of applying for 
Intangible and uncertain data. Data governance must be flexible and viable enough to design various scenarios 
aspects for every application to assess the rate, time, and approach required to respond to any 
data application. This perspective has not been considered in various data applications, 
so these applications would not enjoy data integration. 


This study aims to provide the problem of data access with a structure based on the perceived 
situation given in Table 1. Since data access is part of governance and data governance requires 
a policy to determine key rules (Eryurek et al., 2021), this study focuses on giving weight or 
sense to the experiences gained from the data-access process based on a policy formation. 
Sense-making in human interaction with various systems presenting meaningful displays aims 
to ensure a deeper understanding or perception of complex matters (Pirolli and Russell, 2011). 
Therefore, the outcome of this research may portray a rich picture of the current situation and 
binding rules concerning policy formation relevant to data access in the data governance 
framework. 

Given the significance of perception over complex situations, especially in the case of the 
problematic situation under study, this study has considered using a method for structuring the 
problem so that ‘discovery’, ‘learning’, and ‘obligation’ can be achieved. Governance data 
design requires distancing from conventional organisational data management (Khatri and 
Brown, 2010). This issue can make the current problem more complex and has motivated the 
authors of this study to turn to situation-improving methodologies to deal with this delicate 
problem rather than problem-solving methods. In other words, a shift from an 


optimization/normative paradigm to interpretive/learning paradigm occurs in this study. 


2. Literature review 


Governance is a broad field that has seen the use of several soft operational research methods. 


Scenario planning, soft system methodology, system dynamics, and strategic choice have 
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frequently been used in governance models (Aliahmadi et al., 2022). Specifically, SSM has 
been reported as useful in data governance, corporate governance, energy governance, and 
security governance. This research focuses on developing governance policy, and thus the use 
of SSM in this area is highlighted. Soft system methodology has emerged as a useful tool in 
policy-making in governance. SSM is a process-oriented approach used to understand and 
manage complex situations. The approach involves using qualitative data and systems thinking 
to identify the different perspectives of stakeholders and create a shared understanding of the 
problem at hand. 

Previous research has considered the use of soft system methodology in policy development. 
Azar et al. (2017) designed a model for policy-making based on SSM in the nanotechnology 
sector. Due to the complexity of nanotechnology commercialization policy-making and the role 
of human factors in it, SSM was used to create a rich picture of the policy-making problem and 
its CATWOE definitions. In the conceptual modeling of activities, some activities were directly 
allocated to policy-making, making it a conceptual model for policy-making for 
nanotechnology commercialization. 

Similarly, Monavarian et al. (2020) used SSM as a tool to structure the issue of policy-making 
for electronic banking to overcome uncertainties and set a long-term plan to preserve the future 
position of this industry. The issue was modeled using a two-circle conceptual model, which 
included several steps for creating policy in the electronic banking sector. Therefore, the use of 
SSM in this research focuses on the activities involved in policy-making generation. 

Furthermore, Sujono et al. (2023) proposed a soft-systems thinking approach based on social 
network analysis to map mineral and coal policies by analyzing the law and producing research 
novelty. SSM was used to reflect on the limitations in capturing the highly complex and 
problematic Mining Law research. 

As evident in the reviewed articles, most of the efforts to use SSM in developing policy and 
policymaking are devoted to directly using definitions and conceptual models in the policy- 
making process. However, in this study, an attempt has been made to make the system's 
behaviour meaningful based on SSM, and then policies are extracted and developed based on 
the necessary actions. 

On the other hand, few studies exist on using SSM in determining the governance policy. 
Prasetyo and Surendro (2015) utilized SSM to create a data governance model tailored to the 
organisation's specific requirements. SSM aims to find a suitable model for data governance by 


considering stakeholders’ definitions and perspectives and considering models from DAMA, 
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IBM, and other sources. Ultimately, they created an Effective Data Governance Model using a 
cycle that involves Planning, Coordinating, Implementation, and Monitoring. The goal is to 
ensure data governance aligns with each organisation's unique needs. 

Limited studies have focused on using SSM directly for creating data governance policies, 
and previous models that employed SSM for governance did not utilize the methodology 


suggested in this research. 


3. Methodology 


In order to create an interpretive perspective on improving the current situation under study, 
Soft Systems Methodology (SSM) was employed. SSM is widely associated with 
interpretive/learning paradigms and helps the current ‘thinking’ on a given problem be well 
structured (Azar et al., 2019). Well-structured thinking represents an organized and flexible 
process based on a systematic perspective to deal with problematic situations or circumstances 
for which proper measures must be taken to make them more acceptable, clearer, and calmer 
(Checkland and Poulter, 2007). To put it differently, SSM is a learning system that seeks to 
compromise with the situation constraints and takes targeted actions to achieve improvement 
(Mingers and Rosenhead, 2001). 

SSM implementation takes place in 7 stages, some of which are real-world, while others are 
conceptual (Checkland and Poulter, 2020). In the first stage, a problem is discovered in the real 
world and its situation is considered. Here, the objective is not to define a problem but to 
determine what we seek. In the second stage, the individuals involved in this situation and the 
structure of this problem are depicted in a rich picture. The third stage is the point of departure 
from the real world to the conceptual and systemic one, where the problem's root definition is 
given. Root definition describes an ideal system, its objectives, and the individuals involved 
and introduces influenced and influencing individuals. To create a root definition based on rich 
pictures, a well-known method named CATWOE is used. Owners use CATWOE in forming 
and formulating a root definition of the problem and the following dimensions characterize it: 


e Customers (C): Who are the customers, stakeholders, and individuals that gain or lose? 
e Actors (A): Who are the players and participants in the system? 
e Transformation process (T): What inputs can be transformed into what outputs in this 
process? 
World View (W): What is the world-view basis of the system? 
Owner (O): Who has the power or authority to stop the system? 
e Environment-related factor (E): What environment constraints must be considered in 
this system? 
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In this fourth stage (conceptual model formation), a conceptual model is designed through 
root definitions involving a diagram model of activities with related connections. In this model, 
targeted actions are defined by imperative verbs and are arranged based on their 
interdependence (Mingers and Rosenhead, 2001; Azar et al., 2019). 

SSM performance measures investigated for system evaluation are summarized by three 
main criteria: efficacy, efficiency, and effectiveness. Efficacy emphasizes proper 
transformation and output creation as a result of a process. Efficiency refers to the minimum 
and best use of sources, and effectiveness represents the capacity to reach goals on higher levels 
in the long term (Checkland and Poulter, 2007). 

The fifth, sixth and seventh stages involve comparing real-world and conceptual models, 
defining required variations for improvement and development, and programming for applying 
those variations. Given that the objective of creating these purposeful activities is the 
corresponding mapping of data governance policy, this study does not attempt to model via 
SSM; instead, the focus is to form a data-access policy from the set of data governance programs 
via SSM-based purposeful measures. 

To develop a comprehensive data governance policy using SSM, it is essential to map each 
area of the policy to each activity in the SSM action plan. This approach ensures that all aspects 
of data governance are addressed in the policy and there is a clear understanding of how each 
area of the policy relates to the SSM process. The SSM action plan comprises several activities, 
including problem definition, analysis, feasibility, implementation, and monitoring. Each of 
these activities can be used to develop specific aspects of the data governance policy. For 
example, in the problem definition activity, it is essential to identify the data-related issues that 
must be addressed in the policy. This could include data quality, security, privacy, and 
compliance with relevant regulations. 

According to the above, the policy can be formed based on the conceptual model of SSM. In 
other words, the base of every activity and its contextualizer constitute parts of the rules that 
support the literature-approved policy. 

The current study has utilized the expertise of professionals and specialists in commercial 
banking to develop a rich picture and conceptual model. The methodology used in the research 
involves a qualitative approach that relies on collecting and analysing data from in-depth 
interviews with experts in the field. The experts were selected based on their experience and 
knowledge of commercial banking and were asked to provide insights and perspectives on the 


various components and dynamics of the industry in order to data access in the data governance 
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area. Through this process, a rich picture and conceptual model were developed that provide a 
comprehensive understanding of the data access of commercial banks and their various 
components. The rich picture provides a visual representation of the various components and 
their interrelationships, while the conceptual model offers a more abstract representation of the 


industry that highlights key concepts and relationships between them. 


4. Findings in the data governance area 

4.1. SSM components in the redefinition of data access problem 

4.1.1. A rich picture of the problem 

Creating a rich picture of the problem is an indirect attempt to access the leading establishments 
or institutions, structures, and perspectives in the current situation and ongoing processes that 
help better recognize the problem (Checkland and Poulter, 2007). The rich picture of the 
problem under study includes its engaged and effective roles and the association between them 
based on communication type (interactions, opinions, or data & information transfer) is 


depicted in Figure 1. 
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Figure 1. The rich picture of the data access and flow described in this section 
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4.1.2. CATWOE definitions 


CATWOE includes effective elements in transfer activities and system objectives (Checkland 


and Poulter, 2020). These elements are separately expressed in the following to shed light on 


the components of the problem under study. Table 2 presents the CATWOE definitions. 


Table 2. Definition of CATWOE components for the studied problem 


Item Definition 
1. Bank divisions 
2. Subsidiaries 
C : 
3. Partner companies 
(Customers) . . eee 
4. Dominant or supervisory institutions 
5. Bank customers 
1. Data management department 
A 2. IT Office 
(Actors) 3. Risk office 
4. Organizations & methods Office 
(Trans em ion The input “data requirement” under the transformation process is transformed into the 
output “satisfied requirement through data access”. 
process) 
1. Data access brings about valuation. 
W 2. Data access control reduces the security risk and reporting burden. 
(World view) 3. Obviating the need for data is directly linked to the context of data and the way to 
access them. 
O 1. CEO 
(Owner) 2. Data management committee 
E 1. Dominant laws and reports resulting from state and supervisory apparatuses. 
(Environment 2. Constraints result from collaboration with extra-banking companies through platforms 
Constraints) and other interactive contexts 


4.1.3. Root definition 


According to Checkland and Poulter (2007), the enhancement formula for root definition is 
called PQR, which involves “applying P through Q to achieve R as a goal”. Accordingly and 
based on the definitions of CATWOE components, one can express the root definition of this 
research as follows: “Data governance system provides data access for all divisions and 
stakeholders through safe, efficient, application-friendly methods so that valuation concerning 
job tasks throughout the bank will increase, leading to the development of banking services and 


products.” 


4.1.4. Conceptual model of activities 


The intended conceptual model comprises purposeful activities of the system that must form in 
the framework of fundamental definitions and based on logical dependencies. Based on the 
earned recognition and CATWOE definitions, this problem achieves a set of activities 


compliant with the root definition, as shown in Figure 2. 
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Figure 2. The purposeful activity model for the data access process 


Figure 2 presents 7 purposeful activities hinged on the earned knowledge of the problematic 
situation panned out in two layers. The first layer, incorporating activity numbers | to 6, 
presents issues ranging from data access procedure and application to access permit. The second 
layer includes the retention procedure and documentation of events. Preconceived activities like 
monitoring, control, and measuring based on all purposeful system measures are included in 


this layer. 


4.2. Key fields of data governance policy in the data-access domain 


Given the earned knowledge of the data access problem via SSM and the resulting conceptual 


model facilitating the redefinition of the problem and its purposeful activities, the critical fields 
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of data governance policy among the group of data governance programs gain significance. 

In this section, by the adopted methodology, the key fields of data governance policy are 
elaborated, through which key concepts related to data governance correspond to every measure 
in the conceptual model of SSM. This definition considers performance measures, including 
the three criteria of efficacy, efficiency, and effectiveness and accordingly, the policy rules set 
based on the improved performance of data access procedure are given. 


Table 3 shows the policy fields for the primary layer in the SSM conceptual model. 


Table 3. The fields of data governance policy on data access 
Conceptual model activities Policy fields 
1. Redefining the extent of requirement for data based on organizational mission 
(Dawes, 2010; Janssen et al., 2020; Reichental, 2023) 
Recording data access 


1 applications by 2. Integrating organizational literature based on marketing nomenclature 
organizational (Cheng et al., 2017; Shin et al., 2020) 
duties/tasks 


3. Informing and training staff concerning data-oriented interactions 
(Janssen et al., 2020) 
1. Classifying data in terms of confidentiality and sensitivity 


ae . (Hripcsak et al., 2014; Kim et al., 2014; Reichental, 2023) 
Considering security 


2 requirements and data 


. 2. Determining confidentiality level for extra-organizational and ecosystem- 
access risks 


related interactions 
(Dasgupta et al., 2019) 
1. Defining metadata to describe data 


Froreseme da (Khatri and Brown, 2010; Brous et al., 2016; Abraham et al., 2019) 


application based on 


3 cant 
cece taea 2. Translating data application in terms of intermediary roles in data governance 
P (Gou, 2022; Reichental, 2023) 
: i 1. Preventing access to the online transaction processing system (OLTP) 
pres seers (Mahanti, 2021; Nadal et al., 2022) 
ite aie ne and 2. Focusing on access based on data archive and analytical data centers (OLAP) 
Provision oF data. (Mahanti, 2021; Nadal et al., 2022) 
& vase the data 1. Identifying a safe and efficient channel in terms of data-sharing tasks 
ce err (Borgman et al., 2016; Janssen et al., 2020) 
5 
pies dani 2. Identifying a safe and efficient format in terms of data-sharing tasks 
i aca (Eryurek et al., 2021) 
1. Focusing on approved data management environments 
6 Providing additional aes aaNet) 


f licant see . 
ere eee vey? ie Assigning access to the applicant 


(Janssen et al., 2020) 


As mentioned in the methodology section, the system's performance measures based on the 
above definitions include the three criteria of efficacy, efficiency, and effectiveness, each of 
which can contribute to the fabrication of logical procedures based on the policy. In other words, 
the procedures that determine the details of activities should be investigated in terms of activity- 


measuring criteria. 
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5. Conclusion 


Having investigated various data access applications in Iran's banking industry and scrutinised 
volumes of documents on such applications, this study shed light on the current problematic 
trend through stakeholder interaction. To illustrate the trend and perceive its complex and 
sensitive situation, SSM was employed so that a transparent and proper image of the problem 
as well as its root definition and essential components, could be presented. To this end, various 
trends and procedures were investigated in technical and marketing terms by considering the 
operational steps of SSM in creating a rich picture of the problematic situation in data access in 
the data governance domain. In consequence, the SSM model managed to obtain a list of 
purposeful activities. Upon identifying these activities, the supporting policy corresponding to 
every set of activities based on the data governance literature, specifically in the data access 
field, was studied and mapping between activities and basic principles of governance policy 
was created. 

As shown in the Finding section in Table 3, various policy dimensions were divided into 6 
classes: data application, risk, processing, infrastructure, route, and access, each of which is 
entitled to its own literature. This procedure significantly helps achieve an initial document of 
the data governance policy regarding data access because active fields can be readily segregated 
in terms of roles, communication and data flow, stakeholders, technical developments, and 
organizational tasks. This distinction led to classification and helped structure the complex 
problem of this research and properly identify key fields of data governance policy, hence 
greater convenience in forming the details of this policy and the corresponding procedures. 

This research study achieved an improved situation in the conceptual model out of a 
problematic situation whose dimensions included multi-stakeholders, multi-perspectives, and 
complex aspects. With the help of this new, improved situation in the model, we can decide on 
the data governance policy. Decision-making elements, in this case, were the very key policy 


fields that had already been separately presented for each activity. 
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